flexdesk 0.17.13 → 0.17.14

package/docs/README.md

@@ -29,7 +29,7 @@ FlexDesk is nine entry points that share their code, so you load only what you u
 `@flexdesk/wm`
 
 - [Shell and navigation](components/shell.md): `createShell`, kinds, navigating between them, what a pane tells its chrome.
-- [Panels and desktops](components/panels-and-desktops.md): which panels a page offers, panel sizes, `mountNavPanel`, the desktop bar.
+- [Panels and desktops](components/panels-and-desktops.md): which panels a page offers, panel sizes, `mountNavPanel`, the desktop bar, a saved layout that cannot be read.
 - [Command palette](components/command-palette.md): grouped results, drill-down, disabled rows, prefix-only sources.
 - [Keys, Back and tab layout](components/keymap.md): rebinding the window manager's keys, Back and the breadcrumb, zoom, tab layout.
 

package/docs/best-practices.md

@@ -36,7 +36,7 @@ The rules the reference pages state, gathered in one place. Each item says what
 
 **14. Restyle through the tokens.** Every rule reads its values from `tokens.css`, so swapping that one file restyles the shell. Library classes are `twm-` prefixed, and that prefix is stable; the editor components and the help modal keep the class names they were extracted with. Supply the icon font, or accept that icons show their text names. See [theming and CSS](concepts/styling.md#styling).
 
-**15. Run the state guard strictly in your own code.** `StateGuardService` defaults to `mode: 'warn'`. FlexDesk's own widgets run clean under `'strict'`, so choose strict for your code and add your application's keys on top of `DEFAULT_STATE_GUARD_CONFIG`. See [state guard](concepts/state-guard.md#the-state-guard-who-wrote-that-attribute-0170) and [the default allow-list](concepts/state-guard.md#the-defaults-cover-flexdesks-own-keys-0170).
+**15. Run the state guard strictly in your own code.** `StateGuardService` defaults to `mode: 'warn'`. FlexDesk's own widgets run clean under `'strict'`, so choose strict for your code and add your application's keys on top of `DEFAULT_STATE_GUARD_CONFIG`: a key you write that no FlexDesk widget does is yours to list. The defaults also still allow some keys that no widget writes, which a strict guard lets through unless you filter them out ([what 0.18.0 removed and what stayed](concepts/state-guard.md#thirteen-application-keys-leave-the-defaults-0180)). See [state guard](concepts/state-guard.md#the-state-guard-who-wrote-that-attribute-0170) and [the default allow-list](concepts/state-guard.md#the-defaults-cover-flexdesks-own-keys-0170).
 
 **16. Dispose what you create.** `shell.dispose()` removes the `?` shortcut and the desktop bar along with the rest of the shell. A `NotificationCenter`'s `dispose()` hands the toast helpers back. Menu bars, tables and lists have `dispose()` too.
 

package/docs/components/keymap.md

@@ -4,6 +4,67 @@
 
 The window manager binds a set of keyboard chords: F1 to F12, Backspace, Ctrl+K, Ctrl+Tab, Ctrl/Shift+Arrows, the Alt chords, `?` and Esc. `keymap.bindings` takes any of them back or rebinds it. The same page covers what depends on those keys and on how a user moves around: what Back and the breadcrumb do, the content zoom control (`chrome.zoom`), and the shell options `backToOpenList`, `floatActiveTab` and `tabLayout`.
 
+## The digit chords follow the key's position, not its character (0.17.14)
+
+Alt+1..9 switch to desktop N and Alt+Shift+1..9 move the focused tile to desktop
+N. The keymap now names the digit row by the key's position, `event.code`
+(`Digit1`..`Digit9`), which neither Shift nor the keyboard layout changes, and
+no longer by the character the key types, `event.key`. Through 0.17.13 it read the
+character, so a real Alt+Shift+2 never matched: Shift turns the 2 into `@` on a
+US keyboard and `"` on a German one. Moving a tile worked from the tile's
+context menu but not from the keyboard, while a synthetic event with
+`key: '2'` did match, which hid it. The chord ids are unchanged, so `bindings`
+spelled `Alt+Shift+2` takes back or rebinds the chord whatever the layout.
+
+On every keyboard below, Alt with the key at position 2 now switches to desktop
+2 and Alt+Shift with it moves the tile there (a Mac in a text field is the one
+exception, below):
+
+| Keyboard | That key types | Through 0.17.13 |
+|---|---|---|
+| US | `2`, with Shift `@` | Alt+2 switched; Alt+Shift+2 did nothing |
+| German | `2`, with Shift `"` | the same |
+| French AZERTY | `é`, with Shift `2` | Alt+2 did nothing; Alt+Shift+2 moved the tile |
+| Mac, Option held | `™`, with Shift `€` | neither did anything, outside a text field |
+
+Alt+Shift+N for the desktop you are already on does nothing, and a panel (the
+Navigator, say) cannot be moved to another desktop. The tile menu never offered
+either, and `wm.moveFocusedToDesktop` refuses both itself, so the keyboard
+cannot do what the menu will not.
+
+Four kinds of press are still read by the character, `event.key`, as before:
+
+- **An event with no position.** A synthetic `KeyboardEvent` that sets `key` and
+  no `code` is read by `key`, so a test or a script that dispatches
+  `{ key: '2', altKey: true }` keeps working. So does the numpad, whose `code` is
+  `Numpad2`: with NumLock on its `key` is the digit and it is a digit chord, and
+  with NumLock off its `key` is `ArrowDown` and it is the arrow chord.
+- **AltGr.** Windows reports AltGr as Ctrl+Alt, and a German, French or Spanish
+  layout types `{ [ ] @ # |` on its digit row with it. Those presses are not
+  digit chords: nothing switches, and the character is typed, in a field too.
+- **Option on a Mac, in a text field.** Option changes the character on every
+  Mac layout, and a programmer types on the digit row with it: on a German
+  keyboard Option+5, 6, 7, 8 and 9 type `[ ] | { }` and Option+Shift+7 types
+  `\`, on a Spanish or Swedish one Option+2 types `@`, on a US one `™`. Such a
+  press is an Alt press with no Ctrl and no AltGr state, so nothing in the
+  event tells it from Alt+2 on Windows, and the keymap goes by the platform
+  instead (`navigator.userAgentData.platform`, or `navigator.platform` where
+  the browser has no such property, naming a Mac, an iPhone or an iPad). With
+  focus in an input, a textarea, a select or a `contenteditable="true"`
+  element that press is typing: nothing switches and the character is typed.
+  With focus anywhere else nothing is typed, so it is a chord by position like
+  every other press, and Option+2 switches to desktop 2 on any Mac keyboard. To
+  switch desktops by key while typing on a Mac, leave the field first. Windows
+  and Linux have no such limit: Alt types no character there, so the digit
+  chords work in a field.
+- **Letters.** Alt+H, V, T, N, W and F, and the Alt+letter swallowing, are still
+  named by the character. Letter keys move between layouts (the key that types
+  `w` on AZERTY sits where QWERTY has `z`), so a position would bind the wrong
+  key there. Option+letter on a Mac types a symbol (Option+H is `˙`), which is
+  not a letter, so those chords do not fire on a Mac.
+
+`tests/keymap_digit_row.test.mjs` pins it.
+
 ## Your keys, not the window manager's: `keymap` (0.17.0)
 
 The window manager binds F1..F12, Backspace, Ctrl+K, Ctrl+Tab, Ctrl/Shift+Arrows,
@@ -42,9 +103,11 @@ throw a `TypeError`, so a binding you meant to change never stays in force
 unnoticed.
 
 **A key press is read as loosely as before.** With no bindings every key does
-what it did in 0.16, and a binding takes over every key press its chord was
-read as. Backspace ignores Shift and Alt, so `{ Backspace: false }` also hands
-Shift+Backspace and Alt+Backspace to the page. Alt+T/N/W/F ignore Shift. With
+what it did in 0.16, apart from the digit row, which is read by position (see
+[the digit chords](#the-digit-chords-follow-the-keys-position-not-its-character-01714)),
+and a binding takes over every key press its chord was read as. Backspace
+ignores Shift and Alt, so `{ Backspace: false }` also hands Shift+Backspace and
+Alt+Backspace to the page. Alt+T/N/W/F ignore Shift. With
 Alt held, Ctrl and Meta are ignored, so Alt+Ctrl+H is `Alt+H`. Ctrl+K and
 Ctrl+Tab also match with Meta held, and Ctrl wins when both are held:
 Ctrl+Meta+K is `Ctrl+K`, and Meta+K is `Meta+K` only without Ctrl. Esc and `?`

package/docs/components/layout-widgets.md

@@ -199,3 +199,35 @@ runs on the bottom panel built over it. The bottom panel behaves as it did:
 re-shows its pane, fires `onSelect` and is remembered, as `select` does. A
 remembered tab that is already in front when `remember.read` answers is shown
 again: its pane hears `onShow` and `onSelect` fires, and nothing is written back.
+
+## Tree items with row actions (0.17.14)
+
+`createTreeItem` takes `actions`, in the shape `createTreeNode` takes them:
+
+```js
+const item = createTreeItem({
+    id: path, label, icon: 'description', badge: { text: '65' },
+    actions: {
+        rename: { icon: 'edit',   title: 'Rename', onClick: (id) => startRename(id) },
+        delete: { icon: 'delete', title: 'Delete', onClick: (id) => confirmDelete(id) },
+    },
+});
+```
+
+- Each entry is a `.twm-tree-node__action-btn` (`type="button"`,
+  `data-action`, its `title`, a Material Symbols icon) in a
+  `.twm-tree-item__actions` slot, the row's last child, after the label, the
+  subtitle and the badge.
+- A click on an entry with `onClick` calls `onClick(id, event)` and stops
+  there, so it does not select the item; a double-click on it does not reach
+  TreeView's `onItemDoubleClick` either.
+- The slot is one line at the row's end, shown on hover, on focus within the
+  row and on the selected item. Elsewhere it is transparent and takes no
+  pointer, but its buttons stay in the tab order, so Tab reaches them and
+  shows them. It takes no height of its own (`height: 0`, the buttons centred
+  on the label line), so a row is as tall with actions as without.
+- `createTreeNode`'s action buttons, built by the same code, are now
+  `type="button"` too: inside a form they no longer submit it.
+- Without `actions` the item's markup is what it was. Until 0.17.13 an item
+  had no actions, and an app that added its own slot got no styles for it
+  (STORY-0121).

package/docs/components/menus.md

@@ -133,11 +133,15 @@ const shell = await createShell({
 - **The host gives up the row's height.** `body.twm-body` is a flex column,
   and the row is a fixed-size item in it (`flex: 0 0 auto`). The host still
   takes whatever is left, so it is shorter by the row's height and nothing is
-  drawn under the row. The row's height is the bar's (24px) plus its padding.
-- **It is styled with FlexDesk tokens.** It is a flex row with
-  `padding: var(--space-xxs) var(--space-xs)`, background `var(--surface-1)`,
-  text `var(--text-body)` and a bottom border `var(--surface-0)`, the same
-  border as the top bar. The `.twm-menubar` inside it keeps its own styles.
+  drawn under the row. The row's height is the bar's (24px) plus its padding
+  and its two 1px borders.
+- **It is a band of its own, on FlexDesk tokens (0.17.14).** It is a flex row
+  with `padding: var(--space-xxs) var(--space-xs)`, background
+  `var(--surface-0)` (darker than the top bar), text `var(--text-body)` and a
+  `1px solid var(--border-strong)` border above and below, so it is set off
+  from the top bar and from the tiles under it. Until 0.17.13 it had
+  `var(--surface-1)` and only a `var(--surface-0)` bottom border, and barely
+  stood out (STORY-0122). The `.twm-menubar` inside it keeps its own styles.
 - **It is not part of the top bar.** It is a sibling of `.twm-global-top-bar`,
   not inside it. A window-drag region bound to the top bar
   (`WindowChromeController`'s `topBar`, which defaults to

package/docs/components/panels-and-desktops.md

@@ -10,6 +10,7 @@ The shell's left, right and bottom panels, and its virtual desktops. A kind says
 - [Panels keep the size you dragged them to (0.17.0)](#panels-keep-the-size-you-dragged-them-to-0170)
 - [A navigation panel you drive yourself: `mountNavPanel` (0.17.0)](#a-navigation-panel-you-drive-yourself-mountnavpanel-0170)
 - [Your desktops beside the app's (0.10.0)](#your-desktops-beside-the-apps-0100)
+- [A saved layout that cannot be read (0.17.14)](#a-saved-layout-that-cannot-be-read-01714)
 
 ## Panels a page does not offer (0.17.0)
 
@@ -125,3 +126,58 @@ screen. With neither set anywhere, the bar is what it always was.
 main pane; it used to replace that pane with the active tab alone. A target still
 holding only its seed is replaced, as before. `dispose()` removes the bar, so a
 rebuilt shell paints a fresh one.
+
+## A saved layout that cannot be read (0.17.14)
+
+The shell saves its layout through the host's `state` under the key `desktops`
+and reads it back when it boots. That file can be truncated or edited by hand.
+Text that is not JSON was always handled: the host logs `[host] bad JSON for
+state key desktops` and answers `null`. A layout that is valid JSON but not a
+layout (a split whose `sizes` is a number, a `null` desktop, a split with no
+`children`) used to make `createShell` throw, on every start, until the file was
+deleted by hand, so an app had to vet the file before booting. Others were let
+through half understood: a desktop with no `tree` came back as an empty one.
+
+Now such a layout is ignored. `createShell` resolves, the shell opens its
+default layout exactly as it does when nothing was saved, and one warning names
+the state key and the first thing wrong. The warning reads:
+
+```
+[wm] bad layout for state key desktops (opening the default layout): desktops[0].tree.root.children[1].sizes: expected 2 non-negative numbers, one per child, found 5
+```
+
+The warning goes to the `logger` you pass to `createShell`, else to
+`console.warn`, once per start. It is a single string, like the keymap's, so it
+arrives whole at any logger: a `LoggingService` (or one of its `scoped()`
+loggers) records that line as the message, with the key and the cause in it.
+
+- **All or nothing.** One bad desktop sets the whole layout aside; the shell does
+  not guess which parts to keep. Nothing of the bad layout is drawn, not even
+  the tiles before the damage.
+- **The file is left where it is.** Deleting it would destroy the only copy of
+  what the user was trying to restore. The next time the shell saves the layout
+  (any change to it) that save replaces the file, and until then every start
+  warns again.
+- **What is unreadable** is a shape `serialize()` could not have written:
+  `desktops` not a non-empty array; a desktop that is not an object, or has no
+  `tree` (a `tree` of `null` is a desktop with nothing on it, and is fine); a
+  `panels` or `panelShares` that is not an object; a node that is not a `leaf`
+  or a `split`; a split without a `dir` of `h` or `v`, without children, or
+  whose `sizes` are not one non-negative number per child; a tab without a
+  string `kind`; and a leaf's `tabs`, `pageTabs` or `activeTabIdx` of the wrong
+  type.
+- **What still loads.** Values that are only drawn or coerced are taken as they
+  are: a title (a content factory can return a number), a desktop's `label`,
+  `group` and `fixed`, a panel's flag, a tab's props. A layout saved by an
+  earlier release loads too: the keys that came later (`panelShares`, `group`,
+  `fixed`, a leaf's `pageTabs`) may be missing, and so may a desktop's `id`,
+  `label` and `panels`, and a leaf's `tabs`. Keys it does not know are ignored, a
+  tab of a kind with no factory registered is the usual placeholder tile, and an
+  `activeIdx` past the last desktop is clamped.
+
+`DESKTOPS_KEY` (`'desktops'`) names the key, and `DesktopManager.deserialize`
+throws the `TypeError` above for a blob that cannot be read, which is what
+`wm.load()` catches; `wm.load()` itself does not throw for one.
+
+`tests/saved_layout_unreadable.test.mjs` boots a real shell over each of 78
+shapes of broken layout and over the readable ones.

package/docs/concepts/state-guard.md

@@ -38,8 +38,10 @@ global; choose strict mode in your own code.
 
 `DEFAULT_STATE_GUARD_CONFIG` includes every data key FlexDesk's own widgets
 write, so the shell, dialogs, forms, tooltips, tiles and flow editors run under
-`mode: 'strict'` with no violation. The list also carries some keys that
-FlexDesk itself does not write. Add your application's keys on top:
+`mode: 'strict'` with no violation. The list also carries keys that FlexDesk
+itself does not write, and it has not been audited key by key
+([what 0.18.0 took out and what stayed](#thirteen-application-keys-leave-the-defaults-0180)).
+A key that names your application's concepts is yours to add, on top:
 
 ```js
 const guard = new StateGuardService({ eventBus, logger, config: {
@@ -56,3 +58,64 @@ capital letter becomes `-` plus its lower-case form. So `rowID` is `row-i-d`
 (what `dataset.rowID` writes), not `rowid`; to allow `data-id`, list `id`.
 Before 0.17.0 a camelCase entry never matched, and some entries named keys no
 element carries.
+
+### Thirteen application keys leave the defaults (0.18.0)
+
+**Breaking for an application that writes one of these keys under a strict
+guard.** `DEFAULT_STATE_GUARD_CONFIG.allowedDatasetKeys` no longer lists
+thirteen keys that belonged to one embedding application, not to FlexDesk. No
+FlexDesk widget writes any of them, so nothing FlexDesk draws changes; what
+changes is that a write of one is now on no allow-list. Before 0.18.0 the
+defaults let it through silently, for every application that used them.
+
+| Group, as the list labelled it | Keys removed |
+|---|---|
+| Simulation/scenario state | `scenario-id`, `run-id`, `run-state` |
+| Scenario editor | `mirror-input`, `mirror-input-bound`, `mirror-change-bound`, `override-type` |
+| Calibration page | `info-for` |
+| DSL generator | `dsl-state`, `dsl-section-registered`, `dsl-scrollbars-installed`, `dsl-tabs-bound`, `dsl-controls-bound` |
+
+Those thirteen are the whole change. Every key FlexDesk writes is still
+allowed, and so is every other key those groups held: the generic words
+(`status`, `selected`, `active`, `disabled`, `expanded`, `collapsed`,
+`visible`, `hidden`, `source`, `bound`, `field`, `key`, `column`) and the rest.
+
+**What stays although FlexDesk does not write it.** The defaults are meant to
+include every key a FlexDesk widget writes, and are not limited to them: many
+listed keys are written by no widget, and the list has not been audited key by
+key. Some look like one application's (`series-id`, `dataset-id`, `func-name`
+and `connector-id` among them) and were not part of this change. A strict guard
+built from the defaults therefore lets a write of any such key through without
+a word. If your application does not write one, leave it out of the list you
+pass, spelled kebab-case as the defaults spell it:
+
+```js
+const NOT_MINE = new Set(['series-id', 'dataset-id']);
+const guard = new StateGuardService({ eventBus, logger, config: {
+    ...DEFAULT_STATE_GUARD_CONFIG,
+    mode: 'strict',
+    allowedDatasetKeys: DEFAULT_STATE_GUARD_CONFIG.allowedDatasetKeys.filter((k) => !NOT_MINE.has(k)),
+} });
+```
+
+**Who is affected.** An application whose guard takes its `allowedDatasetKeys`
+from the defaults, by spreading `DEFAULT_STATE_GUARD_CONFIG.allowedDatasetKeys`
+or by leaving the option out, and that writes or removes one of the thirteen
+keys (as `data-scenario-id`, or `dataset.scenarioId`: they are one key). In
+`strict` the call throws
+`StateGuard blocked setAttribute on "data-scenario-id" from …`; in the default
+`warn` mode it is logged and emitted as `state-guard:violation`, on every
+call. An application that passes its own complete list, or that allows the key
+to one module through `allow()` or `moduleOverrides`, is not affected.
+
+**To restore a key**, list it on top of the defaults, as for any key of your
+own (the spelling does not matter: `scenarioId` and `scenario-id` are the same
+key):
+
+```js
+const guard = new StateGuardService({ eventBus, logger, config: {
+    ...DEFAULT_STATE_GUARD_CONFIG,
+    mode: 'strict',
+    allowedDatasetKeys: [...DEFAULT_STATE_GUARD_CONFIG.allowedDatasetKeys, 'scenario-id', 'run-id', 'run-state'],
+} });
+```

package/docs/concepts/styling.md

@@ -8,17 +8,20 @@ Three stylesheets, and that is the whole CSS contract:
 
 | | Specifier | Resolves to | |
 |---|---|---|---|
-| `dist/tokens.css` | `flexdesk/css/tokens` | `css/tokens.css` | Every rule reads `var(--…)` from here. Swap this one file and the shell restyles. |
+| `dist/tokens.css` | `flexdesk/css/tokens` | `dist/tokens.css` | Every rule reads `var(--…)` from here. Swap this one file and the shell restyles. |
 | `dist/reset.css` | `flexdesk/css/reset` | `dist/reset.css` | The reset. |
 | `dist/flexdesk.css` | `flexdesk/css` | `dist/flexdesk.css` | The library. Every class is `twm-` prefixed (the original working name; the prefix is stable and not worth a breaking rename). |
 
 A bundler, an import-map generator or `require.resolve` reaches each one by its
 specifier, through the package's `exports` map, which closes every other path
-into the package. The map sends `flexdesk/css/tokens` to the source
-`css/tokens.css`, not `dist/tokens.css`. The two are identical in a release,
-since `dist/` is rebuilt in the release commit, but can differ on a working
-checkout. `flexdesk/css/reset` is missing from 0.16.1 and earlier,
-where it fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`.
+into the package. All three resolve to the built copy under `dist/`, the file
+the first column names. A specifier therefore never serves a source file that
+has moved on since `dist/` was last rebuilt, which a working checkout or a git
+dependency can hold. In 0.17.13 and earlier `flexdesk/css/tokens` resolved to
+the source `css/tokens.css` instead. The two files are identical in a release,
+since `dist/` is rebuilt in the release commit, so an installed release serves
+the same bytes as before. `flexdesk/css/reset` is missing from 0.16.1 and
+earlier, where it fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`.
 
 `createDetailHeader` follows the prefix too: a badge is a `.twm-detail-header__badge`
 pill (a badge's `className` is added beside it, to recolour it), and an action is a
@@ -179,3 +182,18 @@ Still literals, because they are not the accent: the colours listed in the
 `COLOR_PALETTE`, `#1f77b4` as the colour pickers' default), and the Monaco
 editor theme's selection colours, which Monaco takes as hex values and not
 as CSS.
+
+## Spinners turn without keyframes of your own (0.17.14)
+
+The tile's loading overlay, the DataTable's loading overlay, the computing
+status window and the run-progress dialog each draw a ring with one coloured
+arc and turn it. They turn with `flexdesk.css` alone: it defines their
+`@keyframes` (`twm-tile-loading-spin`, `data-table__spin`, `computing-spin` and
+`etl-spin`), each a full turn.
+
+Up to and including 0.17.13 the stylesheet named those four animations and
+defined none of them. CSS treats an animation with no `@keyframes` as no
+animation, so the rings were drawn and stood still, and an embedder had to
+define the same four names itself to make them move. You can delete those definitions. If you keep
+one, `@keyframes` names are global and the later definition wins, which
+changes nothing unless yours is not a full turn.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "flexdesk",
-    "version": "0.17.13",
+    "version": "0.17.14",
     "description": "A tiling window manager and widget set for desktop-class web applications. Zero runtime dependencies.",
     "license": "MIT",
     "repository": {
@@ -52,7 +52,7 @@
             "development": "./widgets.js"
         },
         "./css": "./dist/flexdesk.css",
-        "./css/tokens": "./css/tokens.css",
+        "./css/tokens": "./dist/tokens.css",
         "./css/reset": "./dist/reset.css",
         "./charts": {
             "import": "./dist/charts.js",

package/src/core/state_guard_config.js

@@ -23,6 +23,22 @@ const DEFAULT_ALLOWED_ATTRIBUTES = Object.freeze([
 const DEFAULT_ALLOWED_ATTRIBUTE_PREFIXES = Object.freeze([
 ]);
 
+// What belongs here: the keys FlexDesk's own widgets write (the last group,
+// which tests/state_guard_defaults.test.mjs keeps complete by scanning src/),
+// the third-party attributes Plotly sets, and generic UI words. What does not:
+// one application's own keys. Whether `data-order-id` is a legitimate write is
+// that application's call, and it says so by adding the key (see
+// docs/concepts/state-guard.md). A key listed here for one embedder's sake that
+// no widget writes is a key every OTHER embedder's strict guard lets through
+// without a word, which is the one thing a strict guard is there to stop.
+//
+// The list does not yet meet that, and it has not been audited key by key:
+// many keys no widget writes are still here, some of them carried over from one
+// application's markup (series-id, dataset-id, func-name and connector-id are
+// examples). Thirteen that name one application's concepts were taken out. The
+// test pins nine of the rest as still allowed, so dropping one is a deliberate
+// edit, and the docs tell an embedder that a strict guard built from the
+// defaults lets a write of such a key through. Do not add another like them.
 const DEFAULT_ALLOWED_DATASET_KEYS = Object.freeze([
     'testid',
     'phase',
@@ -70,11 +86,8 @@ const DEFAULT_ALLOWED_DATASET_KEYS = Object.freeze([
     'node-name',
     'lang',
     'playback-control',
-    // Simulation/scenario state keys
+    // Generic state words
     'status',
-    'scenario-id',
-    'run-id',
-    'run-state',
     'selected',
     'active',
     'disabled',
@@ -90,13 +103,10 @@ const DEFAULT_ALLOWED_DATASET_KEYS = Object.freeze([
     'input-index',
     'output-index',
     'port-index',
-    // Scenario editor keys
+    // Identifier and binding keys
     'source',
     'series-id',
     'dataset-id',
-    'mirror-input-bound',
-    'mirror-change-bound',
-    'mirror-input',
     'bound',
     'field',
     'key',
@@ -105,14 +115,11 @@ const DEFAULT_ALLOWED_DATASET_KEYS = Object.freeze([
     'tab-id',
     'param-id',
     'target-id',
-    'override-type',
     // Tree view component keys
     'item-id',
     'category-id',
-    // Calibration page keys
-    'info-for',
-    'column',
     // Data page keys
+    'column',
     'readonly',
     'id',
     'action',
@@ -131,12 +138,6 @@ const DEFAULT_ALLOWED_DATASET_KEYS = Object.freeze([
     'label',
     'title',
     'description',
-    // DSL generator keys
-    'dsl-state',
-    'dsl-section-registered',
-    'dsl-scrollbars-installed',
-    'dsl-tabs-bound',
-    'dsl-controls-bound',
     // Inline highlighter keys
     'inline-hl',
     // Overlay scrollbar keys (UI-only, not state storage)